package com.kaibes.web.json;

import java.io.IOException;
import java.util.List;

import org.springframework.web.util.HtmlUtils;

import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.DeserializationContext;
import com.fasterxml.jackson.databind.JavaType;
import com.fasterxml.jackson.databind.deser.std.StdDeserializer;

@SuppressWarnings("serial")
public class XssStdDerializer extends StdDeserializer<String>{
    
    private List<String> xssIgnoreList;
    
    public XssStdDerializer(Class<?> vc) {
        super(vc);
    }

    public XssStdDerializer(JavaType valueType) {
        super(valueType);
    }

    public XssStdDerializer(StdDeserializer<?> src) {
        super(src);
    }
    
    public void setXssIgnoreList(List<String> xssIgnoreList) {
        this.xssIgnoreList = xssIgnoreList;
    }

    @Override
    public String deserialize(JsonParser p, DeserializationContext ctxt) throws IOException, JsonProcessingException {
        String name = p.getCurrentName();
        String value = p.getValueAsString();
        if (name != null && value != null) {
            for (int i = 0; i < xssIgnoreList.size(); i++) {
                String temp = xssIgnoreList.get(i);
                if (name.equals(temp)) {
                    return value;
                }
            }
            value = HtmlUtils.htmlEscape(value);
        }
        return value;
    }
    
}
